Pluginus Net
Monthly
Reflected cross-site scripting in the PluginUs.Net TableOn (posts-table-filterable) WordPress plugin affects versions through 1.0.7 and lets a remote, unauthenticated attacker craft a request or link that executes script in a victim's browser only after the victim interacts with it (CVSS UI:R). The available advisory does not identify the exact vulnerable parameter, page, or non-default configuration needed to reach the sink, and no public exploit has been identified at time of analysis. Impact is bounded to the victim's browser session on the affected site, with low confidentiality and integrity impact and no availability impact under the assessed vector.
Blind SQL injection in the PluginUs.Net WOLF bulk-editor WordPress plugin, affecting all versions through 1.1.1, allows an attacker who already holds high-privilege authenticated access to the WordPress site to inject arbitrary SQL through the plugin's bulk-editing input and infer database contents indirectly. Because the injection is blind, extraction is slower and no victim user interaction is required; the practical exposure is limited by the PR:H prerequisite, meaning an administrator-level account or an account with access to the WOLF bulk-editor interface is required before exploitation is possible. No public exploit code was identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided, and the overall priority is moderate rather than emergency.
Reflected cross-site scripting in the HUSKY - Products Filter Professional for WooCommerce WordPress plugin affects all versions up to and including 1.4.3.2, allowing remote attackers to inject script that executes in the browser of a victim who opens a crafted link. Exploitation is not fully automatic: per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) no authentication is required to craft the request, but the victim must interact with attacker-supplied input, after which unsanitized data is reflected into the generated page and can run in whatever session the victim holds, potentially altering page content or leaking session data. No public exploit code was identified and the plugin is not listed in CISA KEV, so this is a moderate, situational risk concentrated on sites running the affected plugin versions.
Unauthenticated local file inclusion in the WordPress 'Meta Data and Taxonomy Filter' (MDTF) plugin by pluginus.net affects all versions up to and including 1.3.8, allowing remote attackers without credentials to coerce the PHP application into including arbitrary local files. Per its CVSS:3.1 vector (AV:N/PR:N), exploitation is network-reachable and unauthenticated, though the high attack complexity (AC:H) implies non-trivial preconditions. This is classified as information disclosure but rated 8.1 with full C/I/A impact; there is no public exploit identified at time of analysis and it is not on the CISA KEV list.
SQL injection in the WordPress "Meta Data Filter & Taxonomy Filter" (MDTF) plugin by pluginus.net affects all versions up to and including 1.3.7, allowing remote attackers to inject arbitrary SQL into backend queries without authentication. Per the provided CVSS vector (PR:N), exploitation requires no login, and the high CVSS base score of 9.3 reflects network reachability plus a scope change. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS data supplied, so prioritization rests on the CVSS signal alone.
Stored cross-site scripting in the MDTF (Meta Data Filter & Taxonomy Filter) WordPress plugin, versions through 1.4.0, lets an authenticated low-privilege user persist a malicious script through a plugin-controlled input field, which then executes in the browser of any privileged user who later views the affected page or admin screen. The vulnerability carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting that exploitation needs a valid low-privileged account plus a victim's page load, but that the resulting script runs with scope change into the surrounding admin context. No public exploit identified at time of analysis, and the flaw is a moderate rather than top-tier priority given the authentication and user-interaction gates.
Information disclosure in Active Products Tables for WooCommerce through version 2.1.3 lets unauthenticated remote visitors retrieve embedded sensitive data from rendered product tables. The issue is CWE-201 and is rated CVSS 5.3 with low confidentiality impact only, no integrity or availability impact; WordPress/WooCommerce sites running the affected plugin are exposed. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Missing authorization in the FOX (WooCommerce Currency Switcher) WordPress plugin through version 1.5.4 allows remote attackers to reach plugin functionality that should require privileged access, tampering with data or settings within the plugin's scope. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N means it is exploitable over the network by unauthenticated attackers with no user interaction, but the consequence is confined to a partial integrity impact - no data disclosure and no availability loss. Severity is moderate (CVSS 5.3), and no public exploit identified at time of analysis; there is no CISA KEV listing for this CVE.
Cross-site request forgery (CSRF) in PluginUs.Net BEAR plugin versions up to 1.1.5 allows unauthenticated remote attackers to perform unauthorized actions on behalf of authenticated users through crafted web requests. The vulnerability requires user interaction (clicking a malicious link) but can modify application state without the user's knowledge or consent. No active exploitation has been publicly confirmed at the time of analysis.
Reflected cross-site scripting in the PluginUs.Net TableOn (posts-table-filterable) WordPress plugin affects versions through 1.0.7 and lets a remote, unauthenticated attacker craft a request or link that executes script in a victim's browser only after the victim interacts with it (CVSS UI:R). The available advisory does not identify the exact vulnerable parameter, page, or non-default configuration needed to reach the sink, and no public exploit has been identified at time of analysis. Impact is bounded to the victim's browser session on the affected site, with low confidentiality and integrity impact and no availability impact under the assessed vector.
Blind SQL injection in the PluginUs.Net WOLF bulk-editor WordPress plugin, affecting all versions through 1.1.1, allows an attacker who already holds high-privilege authenticated access to the WordPress site to inject arbitrary SQL through the plugin's bulk-editing input and infer database contents indirectly. Because the injection is blind, extraction is slower and no victim user interaction is required; the practical exposure is limited by the PR:H prerequisite, meaning an administrator-level account or an account with access to the WOLF bulk-editor interface is required before exploitation is possible. No public exploit code was identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided, and the overall priority is moderate rather than emergency.
Reflected cross-site scripting in the HUSKY - Products Filter Professional for WooCommerce WordPress plugin affects all versions up to and including 1.4.3.2, allowing remote attackers to inject script that executes in the browser of a victim who opens a crafted link. Exploitation is not fully automatic: per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) no authentication is required to craft the request, but the victim must interact with attacker-supplied input, after which unsanitized data is reflected into the generated page and can run in whatever session the victim holds, potentially altering page content or leaking session data. No public exploit code was identified and the plugin is not listed in CISA KEV, so this is a moderate, situational risk concentrated on sites running the affected plugin versions.
Unauthenticated local file inclusion in the WordPress 'Meta Data and Taxonomy Filter' (MDTF) plugin by pluginus.net affects all versions up to and including 1.3.8, allowing remote attackers without credentials to coerce the PHP application into including arbitrary local files. Per its CVSS:3.1 vector (AV:N/PR:N), exploitation is network-reachable and unauthenticated, though the high attack complexity (AC:H) implies non-trivial preconditions. This is classified as information disclosure but rated 8.1 with full C/I/A impact; there is no public exploit identified at time of analysis and it is not on the CISA KEV list.
SQL injection in the WordPress "Meta Data Filter & Taxonomy Filter" (MDTF) plugin by pluginus.net affects all versions up to and including 1.3.7, allowing remote attackers to inject arbitrary SQL into backend queries without authentication. Per the provided CVSS vector (PR:N), exploitation requires no login, and the high CVSS base score of 9.3 reflects network reachability plus a scope change. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS data supplied, so prioritization rests on the CVSS signal alone.
Stored cross-site scripting in the MDTF (Meta Data Filter & Taxonomy Filter) WordPress plugin, versions through 1.4.0, lets an authenticated low-privilege user persist a malicious script through a plugin-controlled input field, which then executes in the browser of any privileged user who later views the affected page or admin screen. The vulnerability carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting that exploitation needs a valid low-privileged account plus a victim's page load, but that the resulting script runs with scope change into the surrounding admin context. No public exploit identified at time of analysis, and the flaw is a moderate rather than top-tier priority given the authentication and user-interaction gates.
Information disclosure in Active Products Tables for WooCommerce through version 2.1.3 lets unauthenticated remote visitors retrieve embedded sensitive data from rendered product tables. The issue is CWE-201 and is rated CVSS 5.3 with low confidentiality impact only, no integrity or availability impact; WordPress/WooCommerce sites running the affected plugin are exposed. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Missing authorization in the FOX (WooCommerce Currency Switcher) WordPress plugin through version 1.5.4 allows remote attackers to reach plugin functionality that should require privileged access, tampering with data or settings within the plugin's scope. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N means it is exploitable over the network by unauthenticated attackers with no user interaction, but the consequence is confined to a partial integrity impact - no data disclosure and no availability loss. Severity is moderate (CVSS 5.3), and no public exploit identified at time of analysis; there is no CISA KEV listing for this CVE.
Cross-site request forgery (CSRF) in PluginUs.Net BEAR plugin versions up to 1.1.5 allows unauthenticated remote attackers to perform unauthorized actions on behalf of authenticated users through crafted web requests. The vulnerability requires user interaction (clicking a malicious link) but can modify application state without the user's knowledge or consent. No active exploitation has been publicly confirmed at the time of analysis.